Cisco Application Control Engine Module Administration Guide

Transcription

1 Cisco Application Control Engine Module Administration Guide Software Version A2(3.0) October 2009 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA USA Tel: NETS (6387) Fax: Text Part Number:

2 THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY. The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB s public domain version of the UNIX operating system. All rights reserved. Copyright 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED AS IS WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R) Copyright Cisco Systems, Inc. All rights reserved.

3 CONTENTS Preface xi Audience xi How to Use This Guide xii Related Documentation xiii Symbols and Conventions xiv Obtaining Documentation, Obtaining Support, and Security Guidelines xvi CHAPTER 1 Setting Up the ACE 1-1 Prerequisites for Setting Up the ACE 1-2 Default Settings 1-2 Setting Up the ACE 1-3 Establishing a Console Connection on the ACE 1-3 Sessioning and Logging In to the ACE 1-4 Changing or Resetting the Administrative Password 1-6 Changing the Administrative Password 1-6 Resetting the Administrator Account Password 1-7 Assigning a Name to the ACE 1-9 Configuring an ACE Inactivity Timeout 1-9 Configuring a Message-of-the-Day Banner 1-10 Configuring the Date and Time 1-12 Configuring the Time Zone 1-12 Adjusting for Daylight Saving Time 1-15 Configuring Terminal Settings 1-17 Configuring Terminal Display Attributes 1-17 Configuring Console Line Settings 1-19 Configuring Virtual Terminal Line Settings 1-20 Modifying the Boot Configuration 1-21 Setting the Boot Method from the Configuration Register 1-21 Setting the BOOT Environment Variable 1-22 Restarting the ACE 1-23 Restarting the ACE from the CLI 1-24 Restarting the ACE from the Catalyst CLI 1-24 Using ROMMON to Specify the System Boot Image During a Restart 1-25 Shutting Down the ACE 1-26 iii

4 Contents Displaying the ACE Setup Configuration 1-27 CHAPTER 2 Enabling Remote Access to the ACE 2-1 Guidelines and Limitations 2-2 Default Settings 2-2 Enabling Remote Access to the ACE 2-3 Task Flow for Enabling Remote Access to the ACE 2-3 Configuring Remote Network Management Traffic Services 2-4 Creating and Configuring a Remote Management Class Map 2-5 Creating a Layer 3 and Layer 4 Remote Access Policy Map 2-8 Applying a Service Policy Globally to All VLAN Interfaces in the Same Context 2-11 Applying a Service Policy to a Specific VLAN Interface 2-12 Configuring the Maximum Number of Telnet Management Sessions 2-14 Configuring SSH Management Session Parameters 2-15 Configuring Maximum Number of SSH Sessions 2-16 Generating SSH Host Key Pairs 2-16 Terminating an Active User Session 2-19 Enabling ICMP Messages to the ACE 2-19 Directly Accessing a User Context Through SSH 2-20 Displaying Remote Access Session Information 2-22 Displaying Telnet Session Information 2-22 Displaying SSH Session Information 2-22 Displaying Other Remote Access Session Information 2-23 Configuration Example for Enabling Remote Access to the ACE 2-24 CHAPTER 3 Managing ACE Software Licenses 3-1 Information about ACE Licenses 3-1 Guidelines and Limitations 3-2 Prerequisites 3-2 Default License Feature Capabilities 3-2 Managing ACE Module Software Licenses 3-3 Tasks for Ordering an Upgrade License and Generating a Key 3-3 Copying a License File to the ACE 3-3 Installing a New or Upgrade License File 3-4 Replacing a Demo License with a Permanent License 3-6 Removing a License 3-6 Removing a Bandwidth or SSL License 3-7 Removing a Virtual Context License 3-7 iv

5 Contents Backing Up an ACE License File 3-9 Retrieving an ACE License File 3-10 Displaying ACE License Configurations and Statistics 3-11 CHAPTER 4 Managing the ACE Software 4-1 Saving Configuration Files 4-1 Saving the Configuration File in Flash Memory 4-2 Saving Configuration Files to a Remote Server 4-2 Copying the Configuration File to the disk0: File System 4-3 Merging the Startup-Configuration File with the Running-Configuration File 4-4 Displaying Configuration File Content 4-4 Clearing the Startup-Configuration File 4-6 Copying Configuration Files from a Remote Server 4-7 Displaying the Configuration Download Progress Status 4-8 Using the File System on the ACE 4-9 Copying Files 4-10 Copying Files to Another Directory on the ACE 4-10 Copying Licenses 4-11 Copying a Packet Capture Buffer 4-12 Copying Files to a Remote Server 4-12 Copying Files from a Remote Server 4-14 Copying an ACE Software System Image to a Remote Server 4-14 Uncompressing Files in the disk0: File System 4-15 Untarring Files in the disk0: File System 4-16 Creating a New Directory 4-17 Deleting an Existing Directory 4-17 Moving Files 4-17 Deleting Files 4-18 Displaying Files Residing On the ACE 4-19 Saving show Output to a File 4-20 Using Backup and Restore 4-22 Information About the Backup and Restore Features 4-22 Archive File 4-23 Archive Naming Conventions 4-23 Archive Directory Structure and Filenames 4-23 Guidelines and Limitations 4-24 Defaults 4-25 Backing Up the ACE Configuration Files and Dependencies 4-25 Restoring the ACE Configuration Files and Dependencies 4-27 v

6 Contents Copying a Backup Archive to a Server 4-31 Displaying the Status of the Backup Operation 4-32 Displaying the Status of the Restoration 4-33 Displaying Backup and Restore Errors 4-33 Managing Core Dump Files 4-35 Copying Core Dumps 4-35 Clearing the Core Directory 4-36 Deleting a Core Dump File 4-37 Capturing Packet Information 4-37 Enabling the Packet Capture Function 4-38 Copying Packet Capture Buffer Information 4-40 Displaying or Clearing Packet Information 4-41 Displaying Packet Information 4-41 Clearing Capture Buffer Information 4-42 Using the Configuration Checkpoint and Rollback Service 4-42 Creating a Configuration Checkpoint 4-42 Deleting a Configuration Checkpoint 4-43 Rolling Back a Running Configuration 4-44 Displaying Checkpoint Information 4-44 Reformatting the Flash Memory 4-45 CHAPTER 5 Displaying ACE Hardware and Software System Information 5-1 Information About Displaying ACE Hardware and Software Information 5-1 Displaying Hardware Information 5-2 Displaying Installed Software Information 5-3 Displaying System Processes and Memory Resources Limits 5-4 Displaying General System Process Information 5-4 Displaying Detailed Process Status Information and Memory Resource Limits 5-7 Displaying System Information 5-9 Displaying or Clearing ICMP Statistics 5-11 Displaying or Collecting Technical Information for Reporting Problems 5-12 CHAPTER 6 Configuring Redundant ACEs 6-1 Information About Redundancy 6-1 Redundancy Protocol 6-2 Stateful Failover 6-3 FT VLAN 6-4 Configuration Synchronization 6-4 vi

7 Contents Redundancy State for Software Upgrade or Downgrade 6-5 Guidelines and Limitations 6-5 Default Settings 6-6 Configuring Redundant ACEs 6-7 Task Flow for Configuring Redundancy 6-7 Configuring Redundancy 6-8 Configuring an FT VLAN 6-9 Configuring an Alias IP Address 6-10 Configuring an FT Peer 6-11 Configuring an FT Group 6-13 Modifying an FT Group 6-15 Specifying the Peer Hostname 6-16 Specifying the MAC Address Banks for a Shared VLAN 6-16 Forcing a Failover 6-17 Synchronizing Redundant Configurations 6-19 Configuring Tracking and Failure Detection 6-21 Configuring Tracking and Failure Detection for a Host or Gateway 6-22 Configuring Tracking and Failure Detection for an Interface 6-25 Configuring Tracking and Failure Detection for an HSRP Group 6-27 Displaying or Clearing Redundancy Information 6-30 Displaying Redundancy Information 6-30 Displaying Redundancy Configuration Information 6-31 Displaying Bulk Synchronization Failures on the Standby ACE 6-31 Displaying FT Group Information 6-32 Displaying the Redundancy Internal Software History 6-35 Displaying the IDMAP Table 6-35 Displaying Memory Statistics 6-36 Displaying Peer Information 6-36 Displaying FT Statistics 6-38 Displaying FT Tracking Information 6-40 Clearing Redundancy Statistics 6-42 Clearing Transport-Layer Statistics 6-42 Clearing Heartbeat Statistics 6-43 Clearing Tracking-Related Statistics 6-43 Clearing All Redundancy Statistics 6-44 Clearing the Redundancy History 6-44 Configuration Example of Redundancy 6-44 vii

8 Contents CHAPTER 7 Configuring SNMP 7-1 Information About SNMP 7-1 Managers and Agents 7-2 SNMP Manager and Agent Communication 7-2 SNMP Traps and Informs 7-3 SNMPv3 CLI User Management and AAA Integration 7-3 CLI and SNMP User Synchronization 7-4 Multiple String Index Guidelines 7-4 Supported MIBs and Notifications 7-5 Default Settings for SNMP 7-30 Configuring SNMP 7-30 Task Flow for Configuring SNMP 7-31 Configuring SNMP Users 7-32 Defining SNMP Communities 7-35 Configuring an SNMP Contact 7-36 Configuring an SNMP Location 7-37 Configuring SNMP Notifications 7-38 Configuring SNMP Notification Hosts 7-38 Enabling SNMP Notifications 7-40 Enabling the IETF Standard for SNMP linkup and linkdown Traps 7-42 Unmasking the SNMP Community Name and Community Security Name OIDs 7-43 Assigning a Trap-Source Interface for SNMP Traps 7-44 Accessing ACE User Context Data Through the Admin Context IP Address 7-45 Accessing User Context Data When Using SNMPv1/v Accessing User Context Data When Using SNMPv Configuring an SNMPv3 Engine ID for an ACE Context 7-46 Configuring SNMP Management Traffic Services 7-47 Creating and Configuring a Layer 3 and Layer 4 Class Map 7-48 Creating a Layer 3 and Layer 4 Policy Map 7-50 Applying a Service Policy Globally to All VLAN Interfaces in the Same Context 7-52 Applying a Service Policy to a Specific VLAN Interface 7-53 Displaying or Clearing SNMP and Service Policy Statistics 7-55 Displaying SNMP and Service Policy Statics 7-55 Displaying SNMP Statistical Information 7-55 Displaying SNMP Service Policy Statistics 7-58 Clearing SNMP Service Policy Statistics 7-59 Example of an SNMP Configuration 7-59 viii

9 Contents CHAPTER 8 Configuring the XML Interface 8-1 Information About XML 8-1 HTTP and HTTPS Support with the ACE 8-2 HTTP Return Codes 8-3 Document Type Definition 8-4 Guidelines and Limitations 8-6 Default Settings 8-6 Configuring the XML Interface 8-7 Task Flow for Configuring XML 8-7 Configuring HTTP and HTTPS Management Traffic Services 8-8 Creating and Configuring a Class Map 8-8 Creating a Layer 3 and Layer 4 Policy Map 8-10 Applying a Service Policy Globally to All VLAN Interfaces in the Same Context 8-13 Applying a Service Policy to a Specific VLAN Interface 8-14 Enabling the Display of Raw XML Request show Output in XML Format 8-15 Accessing the ACE DTD File 8-18 Displaying or Clearing XML Service Policy Statistics 8-19 Displaying XML Service Policy Statistics 8-19 Clearing XML Service Policy Statistics 8-19 Example of ACE CLI and the XML Equivalent 8-20 APPENDIX A Upgrading or Downgrading Your ACE Software A-1 Overview of Upgrading ACE Software A-1 Prerequisites for Upgrading Your ACE A-2 Changing the Admin Password A-2 Changing the www User Password A-2 Checking Your Configuration for FT Priority and Preempt A-2 Creating a Checkpoint A-2 Updating Your Application Protocol Inspection Configurations A-3 Performing Software Upgrades and Downgrades A-4 Task Flow for Upgrading the ACE Software A-4 Task Flow for Downgrading the ACE Software A-7 Copying the Software Upgrade Image to the ACE A-9 Configuring the ACE to Autoboot the Software Image A-10 Setting the Boot Variable A-10 Configuring the Configuration Register to Autoboot the Boot Variable A-11 Reloading the ACE A-11 Recovering the ACE from the ROMMON Utility A-12 ix

10 Contents Booting the ACE from ROMMON with the Correct Image Name A-12 Booting the ACE from an Image Copied to the Supervisor Engine A-14 Displaying Software Image Information A-15 Displaying the Boot Variable and Configuration Register A-15 Displaying the Software Version A-15 I NDEX x

11 Preface This guide provides instructions for the administration of the Cisco Application Control Engine (ACE) module in a Catalyst 6500 series switch or a Cisco 7600 series router, hereinafter referred to as the switch or router, respectively. It describes how to perform administration tasks on the ACE, including doing the initial setup, establishing remote access, managing software licenses, configuring class maps and policy maps, managing the ACE software, configuring Simple Network Management Protocol (SNMP), configuring redundancy, configuring the Extensible Markup Language (XML) interface, and upgrading your ACE software. This preface contains the following major sections: Audience How to Use This Guide Related Documentation Symbols and Conventions Obtaining Documentation, Obtaining Support, and Security Guidelines Audience This guide is intended for the following trained and qualified service personnel who are responsible for configuring the ACE: System administrator System operator xi

12 Preface How to Use This Guide This guide is organized as follows: Chapter Chapter 1, Setting Up the ACE Chapter 2, Chapter 2, Enabling Remote Access to the ACE Chapter 3, Managing ACE Software Licenses Chapter 4, Managing the ACE Software Chapter 5, Displaying ACE Hardware and Software System Information Chapter 6, Configuring Redundant ACEs Chapter 7, Configuring SNMP Chapter 8, Configuring the XML Interface Appendix A, Upgrading or Downgrading Your ACE Software Description Describes how to configure basic settings on the ACE, including topics such as how to session and log in to the ACE, change the administrative username and password, assign a name to the ACE, configure a message-of-the-day banner, configure the date and time, configure terminal settings, modify the boot configuration, and restart the ACE. Describes how to configure remote access to the Cisco Application Control Engine (ACE) module by establishing a remote connection using the Secure Shell (SSH) or Telnet protocols. It also describes how to configure the ACE to provide direct access to a user context from SSH. This chapter also covers how to configure the ACE to receive ICMP messages from a host. Describes how to manage the software licenses for your ACE. Describes how to save and download configuration files, use the file system, view and copy core dumps, capture and copy packet information, use the configuration checkpoint and rollback service, display configuration information, and display technical support information. Describes how to display ACE hardware and software configuration and technical support information. Describes how to configure the ACE for redundancy, which provides fault tolerance for the stateful failover of flows. Describes how to configure SNMP to query the ACE for Cisco Management Information Bases (MIBs) and to send event notifications to a network management system (NMS). Describes how to provide a mechanism using XML to transfer, configure, and monitor objects in the ACE. This XML capability allows you to easily shape or extend the CLI query and reply data in XML format to meet different specific business needs. Describes how to upgrade or downgrade the software on your ACE. xii

13 Preface Related Documentation In addition to this document, the ACE documentation set includes the following: Document Title Release Note for the Cisco Application Control Engine Module Cisco Application Control Engine Module Hardware Installation Note Cisco Application Control Engine Module Getting Started Guide Cisco Application Control Engine Module Administration Guide Cisco Application Control Engine Module Virtualization Configuration Guide Cisco Application Control Engine Module Routing and Bridging Configuration Guide Cisco Application Control Engine Module Server Load-Balancing Configuration Guide Description Provides information about operating considerations, caveats, and command-line interface (CLI) commands for the ACE. Provides information for installing the ACE into the Catalyst 6500 series switch or a Cisco 7600 series router. Describes how to perform the initial setup and configuration tasks for the ACE. Describes how to perform the following administration tasks on the ACE: Setting up the ACE Establishing remote access Managing software licenses Configuring class maps and policy maps Managing the ACE software Configuring SNMP Configuring redundancy Configuring the XML interface Upgrading the ACE software Describes how to operate your ACE in a single context or in multiple contexts. Describes how to perform the following routing and bridging tasks on the ACE: Configuring VLAN interfaces Configuring routing Configuring bridging Configuring Dynamic Host Configuration Protocol (DHCP) Describes how to configure the following server load-balancing features on the ACE: Real servers and server farms Class maps and policy maps to load balance traffic to real servers in server farms Server health monitoring (probes) Stickiness Firewall load balancing TCL scripts xiii

14 Preface Document Title Cisco Application Control Engine Module Security Configuration Guide Cisco Application Control Engine Module SSL Configuration Guide Cisco Application Control Engine Module System Message Guide Cisco Application Control Engine Module Reference Cisco CSM-to-ACE Conversion Tool User Guide Cisco CSS-to-ACE Conversion Tool User Guide Cisco Application Control Engine (ACE) Module Troubleshooting Guide, Release A2(x) Description Describes how to perform the following ACE security configuration tasks: Security access control lists (ACLs) User authentication and accounting using a Terminal Access Controller Access Control System Plus (TACACS+), Remote Authentication Dial-In User Service (RADIUS), or Lightweight Directory Access Protocol (LDAP) server Application protocol and HTTP deep packet inspection TCP/IP normalization and termination parameters Network Address Translation (NAT) Describes how to configure the following Secure Sockets Layer (SSL) features on the ACE: SSL certificates and keys SSL initiation SSL termination End-to-end SSL Describes how to configure system message logging on the ACE. This guide also lists and describes the system log (syslog) messages generated by the ACE. Provides an alphabetical list and descriptions of all CLI commands by mode, including syntax, options, and related commands. Describes how to use the CSM-to-ACE conversion tool to migrate Cisco Content Switching Module (CSM) running- or startup-configuration files to the ACE. Describes how to use the CSS-to-ACE conversion tool to migrate Cisco Content Services Switches (CSS) running-configuration or startup-configuration files to the ACE. Describes the procedures and methodology in wiki format to troubleshoot the most common problems that you may encounter during the operation of your ACE. Symbols and Conventions This publication uses the following conventions: xiv

15 Preface Convention boldface font Description s, command options, and keywords are in boldface. Bold text also indicates a command in a paragraph. italic font Arguments for which you supply values are in italics. Italic text also indicates the first occurrence of a new term, book title, emphasized text. { } Encloses required arguments and keywords. [ ] Encloses optional arguments and keywords. {x y z} Required alternative keywords are grouped in braces and separated by vertical bars. [x y z] Optional alternative keywords are grouped in brackets and separated by vertical bars. string A nonquoted set of characters. Do not use quotation marks around the string or the string will include the quotation marks. screen font Terminal sessions and information the system displays are in screen font. boldface screen font italic screen font Information you must enter in a command line is in boldface screen font. Arguments for which you supply values are in italic screen font. ^ The symbol ^ represents the key labeled Control for example, the key combination ^D in a screen display means hold down the Control key while you press the D key. < > Nonprinting characters, such as passwords are in angle brackets. 1. A numbered list indicates that the order of the list items is important. a. An alphabetical list indicates that the order of the secondary list items is important. A bulleted list indicates that the order of the list topics is unimportant. An indented list indicates that the order of the list subtopics is unimportant. Notes use the following conventions: Note Means reader take note. Notes contain helpful suggestions or references to material not covered in the publication. Cautions use the following conventions: Caution Means reader be careful. In this situation, you might do something that could result in equipment damage or loss of data. For additional information about CLI syntax formatting, refer to the Cisco Application Control Engine Module Reference. xv

16 Preface Obtaining Documentation, Obtaining Support, and Security Guidelines For information on obtaining documentation, obtaining support, providing documentation feedback, security guidelines, and also recommended aliases and general Cisco documents, see the monthly What s New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at: xvi

17 CHAPTER 1 Setting Up the ACE This chapter describes how to initially configure basic settings on the Cisco Application Control Engine (ACE) module in the Catalyst 6500 series switches. It contains the following major sections: Prerequisites for Setting Up the ACE Default Settings Setting Up the ACE Displaying the ACE Setup Configuration For details on assigning VLANs to the ACE, configuring VLAN interfaces on the ACE, and configuring a default or static route on the ACE, see the Cisco Application Control Engine Module Routing and Bridging Configuration Guide. 1-1

18 Prerequisites for Setting Up the ACE Chapter 1 Setting Up the ACE Prerequisites for Setting Up the ACE Setting up the ACE has the following requirements: Terminal The terminal that you use to communicate with the ACE must contain a terminal communications application, such as HyperTerminal for Windows, and be configured as follows: Asynchronous transmission 9600 baud 8 data bits 1 stop bit No parity Cable The cable that connects the terminal to the ACE must meet the following requirements: Serial cable with an RJ-45 connector Cable type Rollover serial cable to connect the ACE to a DTE device For instructions on connecting a console cable to your ACE, see the Cisco Application Control Engine Module Hardware Installation Guide. Default Settings Table 1-1 lists the default settings for the ACE setup parameters. Table 1-1 Default Setup Parameters Parameter Default User accounts Administrator account: username: admin / password: admin XML interface account: username: www: / password: admin Host name switch Inactivity timeout 5 minutes Console port communication parameters 9600 baud 8 data bits 1 stop bit No parity 1-2

19 Chapter 1 Setting Up the ACE Setting Up the ACE Setting Up the ACE This section describes the tasks associated with setting up the ACE and includes the following topics: Establishing a Console Connection on the ACE Sessioning and Logging In to the ACE Changing or Resetting the Administrative Password Assigning a Name to the ACE Configuring an ACE Inactivity Timeout Configuring a Message-of-the-Day Banner Configuring the Date and Time Configuring Terminal Settings Modifying the Boot Configuration Restarting the ACE Shutting Down the ACE Establishing a Console Connection on the ACE Prerequisites Restrictions Detailed Steps This section describes how to establish a direct serial connection between your terminal and the ACE by making a serial connection to the console port on the front of the ACE. The console port is an asynchronous RS-232 serial port with an RJ-45 connector. This setup procedure requires a properly configured terminal and cable as described in the Prerequisites for Setting Up the ACE section. Only the Admin context is accessible through the console port; all other contexts can be reached through Telnet or SSH sessions. Follow these steps to access the ACE using a direct serial connection: Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Connect the serial cable between the ACE and the terminal and then use any terminal communications application to access the ACE CLI. This procedure uses HyperTerminal for Windows. Launch HyperTerminal. The Connection Description window appears. Enter a name for your session in the Name field. Click OK. The Connect To window appears. From the drop-down list, choose the COM port to which the device is connected. Click OK. The Port Properties window appears. Set the following port properties: 1-3

20 Setting Up the ACE Chapter 1 Setting Up the ACE Step 8 Step 9 Baud Rate = 9600 Data Bits = 8 Flow Control = none Parity = none Stop Bits = 1 Click OK to connect. Press Enter to access the CLI prompt. switch login: What to Do Next When the login prompt displays, proceed with the following tasks: Once a session is created, choose Save As from the File menu to save the connection description. Saving the connection description has the following two advantages: The next time that you launch HyperTerminal, the session is listed as an option under Start > Programs > Accessories > HyperTerminal > Name_of_session. This option lets you reach the CLI prompt directly without going through the configuration steps. You can connect your cable to a different device without configuring a new HyperTerminal session. If you use this option, make sure that you connect to the same port on the new device as was configured in the saved HyperTerminal session. Otherwise, a blank screen appears without a prompt. See the Sessioning and Logging In to the ACE section for details on logging in and entering the configuration mode to configure the ACE. Sessioning and Logging In to the ACE This section describes how to connect (session) to the ACE as the default user from either the ACE console port or from the Catalyst 6500 series CLI. Once you connect to the ACE as the default user, you can then log in and enter the configuration mode to configure the ACE. The ACE creates two default user accounts at startup: admin and www. The admin user is the global administrator and cannot be deleted. The ACE uses the www user account for the XML interface. Later, when you configure interfaces and IP addresses on the ACE itself, you can remotely access the ACE CLI through an ACE interface by using the Catalyst console port or by a Telnet or SSH session. To configure remote access to the ACE CLI, see Chapter 2, Enabling Remote Access to the ACE. For details on configuring interfaces on the ACE, see the Cisco Application Control Engine Module Routing and Bridging Configuration Guide. You can configure the ACE to provide a higher level of security for users accessing the ACE. For information about configuring user authentication for login access, see the Cisco Application Control Engine Module Security Configuration Guide. 1-4

21 Chapter 1 Setting Up the ACE Setting Up the ACE Restrictions Only the Admin context is accessible through the console port; all other contexts can be reached through a Telnet or SSH remote access session. Detailed Steps Follow these steps to session into the ACE and access configuration mode to perform the initial configuration: Step 1 Access the ACE through one of the following methods: If you choose to access the ACE directly by its console port, attach a terminal to the asynchronous RS-232 serial port on the front of the ACE. Any device connected to this port must be capable of asynchronous transmission. The connection requires a terminal configured as 9600 baud, 8 data bits, 1 stop bit, no parity. See the Establishing a Console Connection on the ACE section. If you choose to session into ACE, after the ACE successfully boots enter the session command from the Catalyst CLI to Telnet to the ACE: Cat6k-switch# session slot mod_num processor 0 The mod_num argument identifies the slot number in the Catalyst 6500 series chassis where the ACE is installed. Note The default escape character sequence is Ctrl-^, and then x. You can also enter exit at the remote prompt to end the session. Step 2 Log into the ACE by entering the login username and password at the following prompt: switch login: admin Password: admin By default, both the username and password are admin. The prompt changes to the following: host1/admin# To change the default login username and password, see the Changing or Resetting the Administrative Password section for details. Caution You must change the default Admin password if you have not already done so. Otherwise, you will be able to log in to the ACE only through the console port or through the supervisor engine of the Catalyst 6500 series switch or the Cisco 7600 series router. You will not be able to access the ACE using Telnet or SSH until you change the default Admin password. Step 3 To access configuration mode, enter: host1/admin# configure Enter configuration commands, one per line. End with CNTL/Z The prompt changes to the following: host1/admin(config)# 1-5

22 Setting Up the ACE Chapter 1 Setting Up the ACE Changing or Resetting the Administrative Password This section describes how to change or reset the administrative password and includes the following topics: Changing the Administrative Password Resetting the Administrator Account Password Changing the Administrative Password This section describes how to change the administrative password. During the initial login process to the ACE, you enter the default user name admin and the default password admin in lowercase text. You cannot modify or delete the default administrative username; however, for security reasons, you must change the default administrative password. If you do not change the password, then security on your ACE can be compromised because the administrative username and password are configured to be the same for every ACE shipped from Cisco Systems. The administrative username and password are stored in Flash memory. Each time that you reboot the ACE, it reads the username and password from Flash memory. Global administrative status is assigned to the administrative username by default. Note For information about changing a user password, see the Cisco Application Control Engine Module Virtualization Configuration Guide. Caution You must change the default Admin password if you have not already done so. Otherwise, you can log in to the ACE only through the console port or through the supervisor engine of the Catalyst 6500 series switch or the Cisco 7600 series router. 1-6

23 Chapter 1 Setting Up the ACE Setting Up the ACE Detailed Steps Step 1 config Enters global configuration mode. host1/admin# config host1/admin(config)# Step 2 username name1 [password [0 5] {password}] host1/admin(config)# username admin password 0 mysecret_801 Changes the default username and password. The keywords, arguments, and options are as follows: name1 Sets the username that you want to assign or change. Enter admin. password (Optional) Keyword that indicates that a password follows. 0 (Optional) Specifies a clear text password. 5 (Optional) Specifies an MD5-hashed strong encryption password. password The password in clear text, encrypted text, or MD5 strong encryption, depending on the numbered option (0 or 5) that you enter. If you do not enter a numbered option, the password is in clear text by default. Enter a password as an unquoted text string with a maximum of 64 characters. Note If you specify an MD5-hashed strong encryption password, the ACE considers a password to be weak if it less than eight characters in length. Step 3 do copy running-config startup-config host1/admin(config)# do copy running-config startup-config The ACE supports the following special characters in a password:,. / = + - % ~ # $ * ( ) Note that the ACE encrypts clear text passwords in the running-config. (Optional) Copies the running configuration to the startup configuration. Resetting the Administrator Account Password Restrictions This section describes how recover the admin password during the initial bootup sequence of the ACE if you forget the password for the ACE administrator account and cannot access the ACE. You must have access to the ACE through the console port to be able to reset the password for the Admin user back to the factory-default value of admin. Only the Admin context is accessible through the console port. 1-7

24 Setting Up the ACE Chapter 1 Setting Up the ACE Detailed Steps Follow these steps to reset the password that allows the Admin user access to the ACE: Step 1 Connect to the console port on the Catalyst 6500 series switch. Step 2 Session in to the ACE through the console port on the front panel. Step 3 Reboot the ACE from the Catalyst 6500 series CLI. See the Restarting the ACE section for details. Step 4 During the bootup process, output appears on the console terminal. Press ESC when the Waiting for 3 seconds to enter setup mode... message appears on the terminal (see the example below). The setup mode appears. If you miss the time window, wait for the ACE to properly complete booting, reboot the ACE from the Catalyst 6500 series CLI, and try again to access the setup mode by pressing ESC. IXP polling timeout interval: 120 map_pci_xram_to_uspace[149] :: mapping 4096 bytes from 0x map_pci_xram_to_uspace[149] :: mapping 4096 bytes from 0x5a IXP's are up... <Sec 48 :Status of IXP1 7, IXP2 7> map_pci_xram_to_uspace[149] :: mapping bytes from 0x4fd68000 map_pci_xram_to_usenabling intb 57 interrupts pace[149] :: mapping bytes from 0x57d68000 Starting lcpfw process... inserting IPCP klm Warning: loading /itasca/klm/klm_session.klm will taint the kernel: no license See for information about tainted modules Module klm_session.klm loaded, with warnings inserting cpu_util klm create dev node as 'mknod /dev/cpu_util c 236 0' getting cpu_util dev major num making new cpu_util dev node Session Agent waiting for packets. Waiting for 3 seconds to enter setup mode... Entering setup sequence... Reset Admin password [y/n] (default: n): y Resetting admin password to factory default... XR Serial driver version 1.0 ( ) with no serial options enabled ttyxr major device number: 235 Create a dev file with 'mknod /dev/ttyxr c 235 [0-1]' cux major device number: 234 Create a dev file with 'mknod /dev/cux c 234 [0-1]' ttyxr0 at 0x10c00000 (irq = 59) is a 16550A ttyxr1 at 0x10c00008 (irq = 59) is a 16550A No licenses installed... Loading.. Please wait...done!!! Step 5 The setup mode prompts if you want to reset the admin password. Enter y. The Resetting admin password to factory default message appears. The ACE deletes the admin user password configuration from the startup configuration and resets the password back to the factory default value of admin. The boot process continues as normal and you are able to enter the admin password at the login prompt. 1-8

25 Chapter 1 Setting Up the ACE Setting Up the ACE Assigning a Name to the ACE Restrictions Detailed Steps This section describes how to specify a hostname for the ACE or for the peer ACE in a redundant configuration. The hostname is used to identify the ACE and for the command-line prompts. If you establish sessions to multiple devices, the hostname helps you track where you enter commands. By default, the hostname for the ACE is switch. Only the Admin context is accessible through the console port. Step 1 Step 2 Step 3 Step 4 config host1/admin# config host1/admin(config)# hostname name host1/admin(config)# hostname ACE_1 ACE_1/Admin(config)# peer hostname name ACE_1/Admin(config)# peer hostname ACE_2 do copy running-config startup-config ACE_1/Admin(config)# do copy running-config startup-config Enters global configuration mode. Changes the ACE name. The name argument specifies a new hostname for the ACE. Enter a case-sensitive text string that contains from 1 to 32 alphanumeric characters. (Optional) Changes the peer ACE name in a redundant configuration. The name argument specifies a new hostname for the peer ACE. Enter a case-sensitive text string that contains from 1 to 32 alphanumeric characters. (Optional) Copies the running configuration to the startup configuration. Configuring an ACE Inactivity Timeout Restrictions This section describes how to modify the length of time that can occur before the ACE automatically logs off an inactive user by specifying the length of time that a user session can be idle before the ACE terminates the console, Telnet, or SSH session. By default, the inactivity timeout value is 5 minutes. The login timeout command setting overrides the terminal session-timeout setting (see the Configuring Terminal Display Attributes section). 1-9

26 Setting Up the ACE Chapter 1 Setting Up the ACE Detailed Steps Step 1 Step 2 Step 3 config host1/admin# config host1/admin(config)# login timeout minutes host1/admin(config)# login timeout 10 no login timeout host1/admin(config)# no login timeout do copy running-config startup-config host1/admin(config)# do copy running-config startup-config Enters global configuration mode. Configures the inactivity timeout value. The minutes argument specifies the length of time that a user can be idle before the ACE terminates the session. Valid entries are from 0 to 60 minutes. A value of 0 instructs the ACE never to timeout. The default is 5 minutes. (Optional) Restores the default timeout value of 5 minutes. (Optional) Copies the running configuration to the startup configuration. Configuring a Message-of-the-Day Banner This section describes how to configure a message in configuration mode to display as the message-of-the-day banner when a user connects to the ACE. Once connected to the ACE, the message-of-the-day banner appears, followed by the login banner and Exec mode prompt. 1-10

27 Chapter 1 Setting Up the ACE Setting Up the ACE Detailed Steps Step 1 Step 2 config host1/admin# config host1/admin(config)# banner motd text host1/admin(config)# banner motd #Welcome to $(hostname)...# Enters global configuration mode. Configures the message-of-the-day banner. The text argument is a line of message text to be displayed as the message-of-the-day banner. The text string consists of all characters that follow the first space until the end of the line (carriage return or line feed). The pound (#) character functions as the delimiting character for each line. For the banner text, spaces are allowed but tabs cannot be entered at the CLI. To instruct the ACE to display multiple lines in a message-of-the-day banner, enter a new banner motd command for each line that you want to appear. The banner message is a maximum of 80 characters per line, up to a maximum of 3000 characters (3000 bytes) for a message-of-the-day banner. This maximum value includes all line feeds and the last delimiting character in the message. To add multiple lines to an existing a message-of-the-day banner, precede each line by using the banner motd command. The ACE appends each line to the end of the existing banner. If the text is empty, the ACE adds a carriage return (CR) to the banner. You can include tokens in the form $(token) in the message text. Tokens will be replaced with the corresponding configuration variable. For example, enter: $(hostname) Displays the hostname for the ACE during run time. $(line) Displays the tty (teletypewriter) line or name (for example, /dev/console, /dev/pts/0, or 1 ). To use the $(hostname) in a single line banner motd input, you must include double quotes ( ) around the $(hostname) so that the $ is interpreted as a special character at the beginning of a variable in the single line (see the Step example). Do not use the double quote character ( ) or the percent sign character (%) as a delimiting character in a single line message string. For multi-line input, double quotes ( ) are not required for the token because the input mode is different from signal-line mode. When you operate in multi-line mode, the ACE interprets the double quote character ( ) literally. 1-11

28 Setting Up the ACE Chapter 1 Setting Up the ACE Step 3 Step 4 no banner motd host1/admin(config)# do show banner motd do show banner motd host1/admin(config)# no banner motd do copy running-config startup-config host1/admin(config)# do copy running-config startup-config (Optional) Replace a banner or a line in a multi-line banner. (Optional) Display the configured banner message. (Optional) Copies the running configuration to the startup configuration. Examples The following example shows how to span multiple lines and use tokens to configure the banner message: host1/admin(config)# banner motd # Enter TEXT message. End with the character '#'. ================================ Welcome to Admin Context Hostname: $(hostname) Tty Line: $(line) ================================= # Configuring the Date and Time Configuring the Time Zone This section describes how to configure the time zone and daylight saving time of the ACE for display purposes. The ACE time and date are synchronized with the clock from the Catalyst 6500 series supervisor engine. See the Cisco 6500 Series Switch Cisco IOS Software Configuration Guide for details on setting the system clock on the switch. This section contains the following topics: Configuring the Time Zone Adjusting for Daylight Saving Time This section describes how to set the time zone of the ACE. The ACE keeps time internally in Universal Time Coordinated (UTC) offset. 1-12

29 Chapter 1 Setting Up the ACE Setting Up the ACE Detailed Steps Step 1 Step 2 config host1/admin# config host1/admin(config)# clock timezone {zone_name{+ } hours minutes} {standard timezone} host1/admin(config)# clock timezone PST -8 0 Enters global configuration mode. Configures the time zone of the ACE. The keywords, arguments, and options are as follows: zone_name The 8-character name of the time zone (for example, PDT) to be displayed when the time zone is in effect. Table 1-1 lists the common time zone acronyms that you can use for the zone_name argument. hours Hours offset from UTC. The range is from 23 to +23. minutes Minutes offset from UTC. The range is from 0 to 59 minutes. standard timezone Displays a list of well known time zones that include an applicable UTC hours offset. Available choices in the list are as follows: AKST Alaska Standard Time, as UTC 9 hours AST Atlantic Standard Time, as UTC 4 hours BST British Summer Time, as UTC + 1 hour CEST Central Europe Summer Time, as UTC + 2 hours CET Central Europe Time, as UTC + 1 hour CST Central Standard Time, as UTC 6 hours CST Central Standard Time, as UTC hours EEST Eastern Europe Summer Time, as UTC + 3 hours EET Eastern Europe Time, as UTC + 2 hours EST Eastern Standard Time, as UTC -5 hours GMT Greenwich Mean Time, as UTC HST Hawaiian Standard Time, as UTC 10 hours IST Irish Summer Time, as UTC + 1 hour MSD Moscow Summer Time, as UTC + 4 hours MSK Moscow Time, as UTC + 3 hours MST Mountain Standard Time, as UTC 7 hours PST Pacific Standard Time, as UTC 8 hours WEST Western Europe Summer Time, as UTC + 1 hour WST Western Standard Time, as UTC + 8 hours 1-13

30 Setting Up the ACE Chapter 1 Setting Up the ACE no clock timezone (Optional) Removes the clock timezone setting. Step 3 Step 4 host1/admin(config)# no clock timezone do show clock host1/admin (config)# do show clock Fri Aug 7 01:38:30 PST 2009 do copy running-config startup-config host1/admin(config)# do copy running-config startup-config (Optional) Displays the current clock settings. (Optional) Copies the running configuration to the startup configuration. Table 1-1 lists common time zone acronyms that you use when specifying the zone name using the command s zone_name argument. Table 1-1 Common Time Zone Acronyms Acronym Time Zone Name and UTC Offset Europe BST British Summer Time, as UTC + 1 hour CET Central Europe Time, as UTC + 1 hour CEST Central Europe Summer Time, as UTC + 2 hours EET Eastern Europe Time, as UTC + 2 hours EEST Eastern Europe Summer Time, as UTC + 3 hours GMT Greenwich Mean Time, as UTC IST Irish Summer Time, as UTC + 1 hour MSK Moscow Time, as UTC + 3 hours MSD Moscow Summer Time, as UTC + 4 hours WET Western Europe Time, as UTC WEST Western Europe Summer Time, as UTC + 1 hour United States and Canada AST Atlantic Standard Time, as UTC 4 hours ADT Atlantic Daylight Time, as UTC 3 hours CT Central Time, either as CST or CDT, depending on the place and time of the year CST Central Standard Time, as UTC 6 hours CDT Central Daylight Saving Time, as UTC 5 hours ET Eastern Time, either as EST or EDT, depending on the place and time of the year EST Eastern Standard Time, as UTC 5 hours EDT Eastern Daylight Saving Time, as UTC 4 hours MT Mountain Time, either as MST or MDT, depending on the place and time of the year MDT Mountain Daylight Saving Time, as UTC 6 hours 1-14

31 Chapter 1 Setting Up the ACE Setting Up the ACE Table 1-1 Acronym MST PT PDT PST AKST AKDT HST Australia CST EST WST Common Time Zone Acronyms (continued) Time Zone Name and UTC Offset Mountain Standard Time, as UTC 7 hours Pacific Time, either as PST or PDT, depending on the place and time of the year Pacific Daylight Saving Time, as UTC 7 hours Pacific Standard Time, as UTC 8 hours Alaska Standard Time, as UTC 9 hours Alaska Standard Daylight Saving Time, as UTC 8 hours Hawaiian Standard Time, as UTC 10 hours Central Standard Time, as UTC hours Eastern Standard/Summer Time, as UTC + 10 hours (+11 hours during summer time) Western Standard Time, as UTC + 8 hours Adjusting for Daylight Saving Time This section describes how to configure the ACE to change the time automatically to summer time (daylight saving time) by specifying when summer time begins and ends. All times are relative to the local time zone; the start time is relative to standard time and the end time is relative to summer time. If the starting month is after the ending month, the ACE assumes that you are located in the Southern Hemisphere. 1-15

32 Setting Up the ACE Chapter 1 Setting Up the ACE Detailed Steps Step 1 Step 2 config host1/admin# config host1/admin(config)# clock summer-time {daylight_timezone_name start_week start_day start_month start_time end_week end_day end_month end_time daylight_offset standard timezone} host1/admin(config)# clock summer-time Pacific 1 Sun Apr 02:00 5 Sun Oct 02:00 60 Enters global configuration mode. Configures the ACE to change the time automatically to summer time (daylight saving time). The keywords, arguments, and options are as follows: daylight_timezone_name The eight-character name of the time zone (for example, PDT) to be displayed when summer time is in effect. See Table 1-1 for the list the common time zone acronyms used for the daylight_timezone_name argument. start_week end_week The week, ranging from 1 through 5. start_day end_day The day, ranging from Sunday through Saturday. start_month end_month The month, ranging from January through December. start_time end_time Time, in military format, specified in hours and minutes. daylight_offset Number of minutes to add during the summer time. Valid entries are 1 to standard timezone Displays a list of well known time zones that include an applicable daylight time start and end range along with a daylight offset. Available list choices are as follows: ADT Atlantic Daylight Time: 2 a.m. 1st Sunday April to 2 a.m. last Sunday Oct, + 60 min AKDT Alaska Standard Daylight Time: 2 a.m. 1st Sunday April to 2 a.m. last Sunday Oct, + 60 min CDT Central Daylight Time: 2 a.m. 1st Sunday April to 2 a.m. last Sunday Oct, + 60 min EDT Eastern Daylight Time: 2 a.m. 1st Sunday April to 2 a.m. last Sunday Oct, + 60 min MDT Mountain Daylight Time: 2 a.m. 1st Sunday April to 2 a.m. last Sunday Oct, + 60 min PDT Pacific Daylight Time: 2 a.m. 1st Sunday April to 2 a.m. last Sunday Oct, + 60 min 1-16

33 Chapter 1 Setting Up the ACE Setting Up the ACE no clock summer-time (Optional) Remove the clock summer-time setting. Step 3 host1/admin(config)# no clock summer-time do copy running-config startup-config host1/admin(config)# do copy running-config startup-config (Optional) Copies the running configuration to the startup configuration. Configuring Terminal Settings Restrictions This section describes how to access the ACE CLI by using one of the following methods: Make a direct connection by using a dedicated terminal attached to the console port on the front of the ACE. Establish a remote connection to the ACE through the Catalyst 6500 series switch using the Secure Shell (SSH) or Telnet protocols. This section contains the following topics: Configuring Terminal Display Attributes Configuring Console Line Settings Configuring Virtual Terminal Line Settings For details on configuring remote access to the ACE CLI using SSH or Telnet, see Chapter 2, Enabling Remote Access to the ACE. This configuration topic includes the following restrictions: Only the Admin context is accessible through the console port; all other contexts can be reached through Telnet or SSH. The login timeout command setting overrides the terminal session-timeout setting (see the Configuring an ACE Inactivity Timeout section). Configuring Terminal Display Attributes Restrictions This section describes how to specify the number of lines and the width for displaying information on a terminal during a console session. The maximum number of displayed screen lines is 511 columns. 1-17